Cyber Security Control & IT Risk Review

It is an independent check on whether your organisation's cybersecurity policies and technical controls are properly designed and are actually being followed in practice — not just written down. We map your IT risk areas, test access controls, network security, data protection practices, incident response readiness, and vendor risk against a recognised framework, then report gaps to your Board or Audit Committee with a prioritised plan to fix them.

No. A penetration test (VAPT) actively attempts to technically exploit vulnerabilities in your systems and networks to see what an attacker could achieve. A Cyber Security Control & IT Risk Review takes a broader governance and controls view — policies, access management, vendor risk, incident response readiness, and regulatory compliance — and evaluates whether the overall control environment is sound. The two are complementary; many clients commission VAPT as a technical component within the broader review, but they are not interchangeable.

It depends on your regulatory category. SEBI-registered intermediaries and market infrastructure institutions (stock brokers, mutual funds/AMCs, depository participants, RTAs, exchanges, clearing corporations, and similar Regulated Entities) fall under SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), which mandates periodic risk assessment and Board-level reporting; listed companies generally (even if not a CSCRF-covered intermediary) carry a narrower cybersecurity incident and materiality disclosure obligation under SEBI's LODR Regulations. Banks, NBFCs, and payment system operators fall under RBI's cybersecurity framework circulars, which require a Board-approved cybersecurity policy and periodic VAPT. Every entity that is a 'designated entity' under CERT-In's April 2022 directions has specific logging and incident-reporting obligations. If none of these apply to you directly, the review is not a standalone statutory requirement — but it remains good governance practice, particularly if IT systems underpin your financial reporting (relevant to your statutory auditor's Section 143(3)(i) opinion) or if you handle personal data that will trigger obligations under the Digital Personal Data Protection Act 2023.

CSCRF is SEBI's consolidated cybersecurity framework applicable to SEBI-registered intermediaries and market infrastructure institutions in the securities market — stock exchanges, depositories, clearing corporations, stock brokers, mutual funds/AMCs, RTAs, depository participants, and other categories of SEBI Regulated Entities — that brought together and updated the earlier sector-specific cyber circulars into a single framework. It requires periodic cyber risk assessments, defined incident detection and reporting timelines, a designated CISO function reporting to the Board, and specific controls around data localisation and audit requirements depending on the entity category. Listed companies that are not themselves SEBI-registered intermediaries fall outside CSCRF's direct scope but carry a related, narrower obligation — cybersecurity incident and materiality disclosure under SEBI's LODR Regulations.

CERT-In (Indian Computer Emergency Response Team), under Section 70B of the Information Technology Act 2000, issued directions in April 2022 that apply broadly to entities operating computer resources in India. Key obligations include: reporting specified categories of cyber security incidents (data breaches, ransomware, unauthorised access, and others listed in the directions) to CERT-In within six hours of detection or of being made aware of the incident; maintaining logs of all ICT systems for a rolling period of 180 days, stored within India; and synchronising system clocks to designated time sources. These directions apply broadly — not just to large or regulated entities.

Where your financial reporting depends on IT systems — which is the case for virtually every company today — your statutory auditor's opinion under Section 143(3)(i) of the Companies Act 2013 on Internal Financial Controls, and the CARO 2020 commentary on internal controls, both implicitly rely on the IT General Controls underneath your financial systems: access management, change management, backup and recovery. A cybersecurity control review conducted ahead of the year-end audit surfaces and fixes these gaps proactively, rather than having the statutory auditor discover them during audit fieldwork and raise them as findings or management letter points.

We typically assess against COBIT 2019 for governance and management objectives, cross-referenced with ISO/IEC 27001:2022 Annex A controls and, where relevant, the NIST Cybersecurity Framework — and map findings to the specific applicable Indian regulatory requirement (SEBI CSCRF, RBI framework, CERT-In directions, DPDP Act) so the report is directly useful for your actual compliance obligations, not just a generic international benchmark.

A first-time review for a mid-sized company typically takes 6–8 weeks for the assessment and report, followed by remediation verification 2–3 months later. Larger or more complex organisations, or those with multiple regulated entities/subsidiaries in scope, take longer. Subsequent-year reviews, building on an established asset inventory and control matrix, are typically faster since the framework only needs updating for what has changed.

The fee depends on the number of systems and locations in scope, whether VAPT is bundled in, the applicable regulatory framework, and organisational size and complexity. PNPC provides a written scope and fixed fee after the initial scoping conversation — we do not quote a number before understanding your IT footprint and regulatory category, because a review scoped for a 30-person single-office company and one scoped for a multi-entity, RBI-regulated group are not comparable engagements.

Internal IT teams are usually the ones who designed and operate the controls being tested — an internal self-review has an inherent conflict of interest and, more practically, an internal team often cannot see its own blind spots. Independent review provides objectivity the Board and Audit Committee (and, where applicable, a regulator) can actually rely on. It is also frequently a specific expectation under SEBI CSCRF and RBI's cybersecurity framework that the assessment carries genuine independence from day-to-day IT operations.

PNPC's role in this engagement is to report findings to your Board, Audit Committee, or IT Strategy Committee — the decision on any external disclosure (to a regulator, to affected data subjects, or otherwise) rests with your organisation and its legal counsel, guided by the specific statutory trigger involved. Where a finding relates to an actual incident that meets CERT-In's reportable categories, the six-hour reporting clock is a separate, time-bound legal obligation that exists independently of our review — we flag this immediately if we identify it during fieldwork.

PNPC scopes and coordinates VAPT as part of a combined engagement where clients want both the governance-level control review and the technical penetration test, working with specialised technical testing partners for the hands-on exploitation work while PNPC leads the overall scoping, framework mapping, Board reporting, and remediation governance.

The DPDP Act 2023 is India's comprehensive data protection legislation, governing how organisations (data fiduciaries) collect, process, store, and protect personal data of individuals (data principals). It introduces obligations around consent, purpose limitation, data breach notification, and reasonable security safeguards, with the detailed operational rules and effective-date provisions being notified in phases. As part of this review, we assess your data classification, encryption, retention, and consent-architecture readiness against the Act's requirements, so that when the operational rules are fully in force, your control environment is not starting from zero.

IT General Controls are the foundational controls over an IT environment that support the reliability of application-level controls and, in turn, financial reporting — access management (who can get into a financial system and how that is granted/removed), change management (how changes to system configuration are approved and tested), backup and recovery (whether financial data can actually be restored if lost), and job scheduling (whether automated financial processes run reliably and completely). If ITGCs are weak, an auditor cannot rely on any application control that depends on that IT environment — which can significantly increase the scope and cost of substantive testing in the statutory audit.

We classify findings using a consistent risk-rating methodology based on the likelihood of the control gap being exploited or causing harm, and the potential impact if it is — financial, regulatory, reputational, or operational. A Critical finding typically involves an active exploit path to sensitive data or financial systems with no compensating control. High findings represent a significant control gap that is not immediately exploitable but poses material risk. Medium and Low findings represent design or process gaps with lower immediate risk but that still warrant remediation to avoid future exposure.

Many cyber-liability insurers now require or reward evidence of an independent, recent security assessment as part of underwriting — some proposal forms ask for it directly, and insurers increasingly price premiums based on demonstrated control maturity rather than self-certified questionnaires alone. A completed review with a clean or well-remediated findings profile can support both the underwriting process and, in some cases, more favourable terms, though PNPC does not control or guarantee insurer pricing decisions.

Not necessarily as a full framework-based review. Very early-stage companies with minimal customer data, no regulatory trigger, and no near-term funding or enterprise-sales requirement are generally better served by a lighter security hygiene checklist folded into their broader IT and accounting setup. The formal review becomes proportionate once you handle meaningful customer data, approach a funding round where investor due diligence will ask about it, or start selling to enterprise customers whose vendor onboarding requires evidence of a control environment.

These are severity classifications commonly used in control assessments, borrowed from the same conceptual framework used in Internal Financial Controls reporting. A control deficiency exists when a control is not designed or operating in a way that allows timely prevention or detection of a risk, but the impact is limited. A significant deficiency is more severe and merits attention from those responsible for governance. A material weakness represents a reasonable possibility that a material misstatement, breach, or loss will not be prevented or detected in a timely manner — the most serious category, typically requiring immediate Board and, where relevant, auditor attention.

The core review is a periodic point-in-time (or period-of-review) assessment, not continuous monitoring — continuous security operations (SIEM alerting, 24x7 SOC) is a different, always-on managed service that PNPC does not itself operate. What PNPC does provide is remediation tracking through to verified closure, and typically an annual or regulator-cadence-aligned refresh review, so your control environment does not go untested again until the next incident or audit finding forces the issue.

A Chief Information Security Officer (CISO) is the designated individual accountable for an organisation's information security posture and its reporting to the Board or a Board committee. SEBI's CSCRF specifically requires designated regulated entities to have a CISO function with a defined reporting line. RBI's framework similarly expects clear ownership of cybersecurity at a senior level for regulated entities. Even where not mandated, having a named accountable owner — whether a dedicated CISO, a CTO with the responsibility formally assigned, or an outsourced virtual CISO arrangement — is fundamental to the control environment actually functioning, since a review with no accountable owner on the other end tends to see its remediation roadmap stall.

For groups with operations spanning India and the UAE, we coordinate the review across jurisdictions under one engagement — assessing the Indian entity against SEBI/RBI/CERT-In/DPDP Act requirements as relevant, and coordinating with the UAE entity's own data protection and cybersecurity obligations under UAE federal and free-zone frameworks, so the Board gets one consistent risk picture rather than two disconnected reports from two different advisors.

Yes. Absence of documented policy is itself a finding, and one of the most common starting points we see. We assess actual practice against the applicable framework regardless of whether formal policy exists, and the remediation roadmap will typically include drafting or formalising the missing policy documents as a first-tier action item alongside any technical control gaps.

Generally no. The review is predominantly document review, interviews, configuration exports, and log analysis rather than intrusive testing of live systems. Where any testing does touch production systems (such as certain access control tests), we schedule it in coordination with your IT team during low-impact windows and confirm the approach in advance.

A management self-assessment is an internal exercise — typically a checklist completed by the IT or security team itself, with no independent testing of whether the answers reflect reality. It carries no external assurance value for a Board, auditor, or regulator. A Cyber Security Control & IT Risk Review is performed by an independent party, involves actual testing of evidence (access logs, configuration exports, sampled transactions) rather than self-reported answers, and produces a report that carries genuine evidentiary weight for governance and, where relevant, regulatory purposes.

Potentially, depending on your policy terms — many cyber-liability policies include representations and warranties about the security controls in place at the time of underwriting, and a documented history of known, unremediated Critical or High findings could be relevant to a claim if the breach exploited exactly that gap. This is a reason to treat remediation follow-through seriously, not just the initial assessment, and to discuss any material findings with your insurance broker or legal counsel.

Yes, increasingly — not because of a direct statutory mandate, but because enterprise customers, investors, and insurers now routinely ask for evidence of a tested security control environment as a precondition of doing business. A mid-sized unlisted company selling into enterprise or government accounts, or approaching a Series A/B round, frequently finds this review requested as part of the counterparty's own due diligence checklist, well before any regulator would require it directly.

Where core financial systems are hosted and managed by a third-party SaaS provider, the relevant ITGCs partly shift to that provider's environment. We assess what controls remain your organisation's responsibility (user access management within the application, approval workflows configured within the tool) versus what should be evidenced by the provider's own certifications (SOC 2 report, ISO 27001 certificate) — and flag where a provider cannot or will not furnish that evidence as a vendor risk finding in its own right.

We specifically request and review the prior year's statutory audit management letter and any IT-related findings as an input to scoping — a review that ignores what the statutory auditor already flagged risks either duplicating known findings without adding value or, worse, missing that a previously flagged gap was never actually closed.

Yes. Remote and hybrid work materially expands the attack surface — VPN configuration and usage discipline, endpoint security on personally-owned (BYOD) devices, use of personal email or unsanctioned file-sharing tools for company data, and physical security of devices outside the office are all assessed as part of the access and endpoint control review, particularly for organisations that shifted to hybrid arrangements without formally updating their security policy to match.

A written report covering: the scope and methodology, the risk and control matrix mapped to the applicable framework, detailed findings with severity classification and evidence references, a prioritised and owner-assigned remediation roadmap, and an executive summary suitable for Board or Audit Committee presentation. PNPC also delivers the findings in person to the Board, Audit Committee, or IT Strategy Committee where requested, rather than simply emailing a PDF.

No. We agree report distribution and confidentiality handling with the engaging party (typically the Audit Committee or CFO/CISO) at the outset. Detailed technical findings, particularly anything classified Critical, are handled on a need-to-know basis, since a full vulnerability report circulated too widely can itself become a security risk if it falls into the wrong hands before remediation is complete.

Yes, and for organisations with an internal audit function under Section 138 of the Companies Act 2013, coordinating the cybersecurity review's timing and scope with the internal audit plan avoids duplicated effort and gives the Audit Committee one integrated risk picture rather than two separately-scheduled, overlapping reviews.

There is no fixed trigger point in terms of company age — it is driven by risk exposure: the volume and sensitivity of data handled, whether a regulatory category applies, and whether enterprise customers or investors are asking for it. A company can be five years old with minimal data exposure and not yet need this review, or two years old and already need it because it processes payment data or is approaching a Series A round with investor due diligence in view.